Home › Stories
NASA and Morton Thiokol · January 1986

Prove It Isn't Safe

The night before Challenger launched, the engineers who built its boosters said don't fly. They were asked to prove it.

◷ 2 min read

At about 8:45 on the evening of January 27, 1986, a conference call began between NASA and Morton Thiokol, the Utah company that built the space shuttle’s solid rocket motors. Challenger was scheduled to launch the next morning. The forecast at launch time was about 26 degrees Fahrenheit.

Thiokol’s engineers had faxed over their charts. Their worry was the rubber O-rings that sealed the joints of the rocket motors. After a cold launch a year earlier, in January 1985, they had found the grease between the seals turned black. “When I say black,” the engineer Roger Boisjoly later testified, “I mean black just like coal.” Their conclusion, presented by the vice president of engineering, Bob Lund: don’t launch if it’s colder than 53 degrees.

NASA’s managers pushed back. Someone on the call pointed out that soot had also leaked past a seal on a flight launched at 75 degrees. Boisjoly was asked to put a number on his concern. “I said I couldn’t,” he testified. “I had no data to quantify it.” Lawrence Mulloy, who ran the booster project for NASA, was later quoted as asking, “My God, Thiokol, when do you want me to launch, next April?” He told the commission the quote was out of context.

Thiokol asked for a five-minute break to talk privately. It lasted about 30 minutes.

In that room, Boisjoly and another engineer, Arnie Thompson, tried again. Thompson walked up to the managers’ end of the table and sketched the joint on a pad. Boisjoly went back over the photos. Then, Boisjoly testified, a senior vice president, Jerry Mason, said they had to make a management decision. He turned to Lund and asked him “to take off his engineering hat and put on his management hat.”

Thiokol came back on the line and recommended launch. Boisjoly: “I was never asked nor polled.”

Lund later tried to describe to the commission what had happened to him that evening. Usually, he said, the contractor had to prove a flight was ready. That night they had to prove it wasn’t. “The roles kind of switched.”

Challenger lifted off at 11:38 the next morning. The air temperature was 36 degrees, 15 degrees colder than any previous launch. Seventy-three seconds later, the shuttle broke apart. All seven crew members died.

The commission found that the people who made the final decision didn’t know about the engineers’ original written recommendation against launching below 53 degrees, or that the engineers kept opposing it after their own managers changed course.

What this story shows

Pre-mortemThe question that night was "can you prove it will fail?", the reverse of a pre-mortem's "it failed, so why?"GroupthinkNot one engineer in the room spoke in favor of launching. Once it became "a management decision," it didn't matter.Decisions Require DissentThe engineers did dissent, clearly and on charts. The meeting was set up so their dissent had to meet a standard of proof it could never meet.Normalization of DevianceSeal erosion on earlier flights had been accepted, and a launch constraint added after one flight's damaged seal had been waived six flights in a row. NASA's booster manager later testified that his point on the call was that they had flown 24 times without a temperature limit.

Sources

  1. Report of the Presidential Commission on the Space Shuttle Challenger Accident, Volume 1, Chapter V, The Contributing Cause of the Accident, 1986
  2. Report of the Presidential Commission on the Space Shuttle Challenger Accident, Volume 1, Chapter III, The Accident, 1986
  3. Report of the Presidential Commission on the Space Shuttle Challenger Accident, Volume 1, Chapter I, Introduction, 1986